If you use the All in One Security plugin then update to the latest version and have all users create new passwords. They were writing all passwords in clear text in the plugin’s audit logs.